Professional Skills for Information and Communication Technology

This document discusses the importance of cyber security for ABC Technologies and identifies security vulnerabilities and threats. It provides recommendations to protect homes and offices from cyber attacks.

Professional Skills for Information and Communication Technology
Name of the Student
Name of the University
Author Note

Table of Contents
Introduction................................................................................................................................3
What is Cyber Security?.........................................................................................................3
Why is it important for ABC Technologies?.........................................................................7
Identification and explanation of 3 security vulnerabilities in the system for ABC
Technologies with proper justification taken from the research............................................8
Identification of and listing of 5 different kinds of threats that might affect the ABC
Technologies..........................................................................................................................9
Description of the threats with their capability of causing the damages................................9
Responsibility of the attacks and the attacking techniques..................................................10
Recommendations for keeping the home and offices away from any kind of cyber attacks
..............................................................................................................................................11
Conclusion................................................................................................................................11
References................................................................................................................................13

Introduction
ABC Technology is an organization established in Australia that is most concerned
with its security system and the reputation that it has in the market. For this, the organization
has hired or employed a Security Consultant to help with the analysis of the entire
organization including the analysis about its employees to have a clear understanding of the
organization as well as the security system that the company is currently having. The
company deals with a huge number of high-tech products of different varieties which
includes a varied range of hardware and software systems that is regarded as the primary
presentation of the company on how it provides products and services to the customers (Safa
et al. 2015). The organization is extremely advanced and it has also adopted extremely
advanced technological features for the companies that is serving as well. The features and
services that it offers to the customers, all utilizes the facilities provided by the cyberworld.
There had been incidents in the organization before that had caused several attacks on the
organization and had fallen a victim to the random number of cyberattacks led by various
numbers of malicious attackers. This why the company has been extremely worried about the
situation and is concerned about all the confidential data that the organization has right now
and does not want that to be compromised. This is why they have been looking forward to the
Security Consultant for providing them with the analysis of their existing cyber security
system so that they can think about implementing a better and technologically advanced
security system and eradicate all the security related problems about the organization so that
they do not lose the reputation of the organization in the market and retain the trust of their
old employees.

What is Cyber Security?
In general terms, cyber security can be defined as the protective systems that are
present in the cyber world that is required to protect or shield the devices or the systems
connected to the internet. These devices or systems may include the software, hardware and
the most intricate data and information originated from the individual user or from an
organization (Layton 2016).
Computing is a concept that utilizes the tow very distinctive security feature,
including the physical security that is related to the devices used for computing and the other
would be the security of the devices that would be connected to the cyber world and the
security of the devices that is connected to the internet and is extremely under usage for the
communications established through the medium of internet. Both of these security forms are
used by individual users and also by the like of organizations irrespective of their company
sizes. There are various ways by which the internet is let passed through several protections
before entering to establish a communication between these devices and this is mostly
formulated with the utility of the devices with the help of protective systems implemented on
these devices so that any unethical access to the device can be identified and stopped from
occurring. The cyber security systems are mostly designed to provide the organization with a
set of concepts that helps the maintenance of extreme confidentiality, data integration and
availability of existing data, which helps in the forming of the cyber security subsets for the
devices connecting to the cyber world.
It is however, never found that the cyber security is a single-handed operation and the
implementation of the cyber security systems are not even found alone in the cyber world
throughout. It ensures that a computing device is extremely secured in the cyber world and it
also ensures that when these devices utilizes the benefits of the cyber world. This includes the

coordination of all the efforts to provide security of the systems right from the beginning to
the end about their information systems. The efforts that are mostly found in the cyber world
about the cyber security systems can be listed as follows:
 Information security
 Application Security
 Business Continuity Planning
 Network Security
 End user education of awareness spreading
 Disaster Recovery
 Operational Security
There are many solutions available in the cyber world that are applied to the
computing devices and the networking systems that even the organization utilizing the
benefits of the cyber world understands how threatening it is to have an information system
in the business without a proper cyber security system and this is why they are looking for the
utilization of the systems to keep away from the vulnerabilities of falling victim to the
security attacks. Every individual user and even the organization face the cyber security
threats and they are found to becoming much more sophisticated given the advanced in the
technological fields and the evolving nature of the cyber security risks as a result of that
(Pathan 2016). The ways by which the organizations have started to implement more and
more cyber security protections to the organization clearly makes it easy to understand on
how the attacks have become more and more capable of damaging the security systems.
Where it can be said as an example that the previous times witnessed that the cyber
security threats within the organization only focused on the known components that were
identified as the most important ones. They did not focus much on the systems that had

moderate risks and because they were not even identified, the systems would be left as
undefended systems. Therefore, it was very obvious that the potential of the cyber crime was
much more increased due to the undefended system that the cyber criminals identified in a
much easier way. The attack was much easier to occur this way.
It has been reported that there are a huge variety of cyber security threats that are
identified to be developing with the implementation of the increasingly evolving cyber
security threats. For this, security systems are also emerging with respect to that as well. It is
difficult to achieve as the threats are becoming more sophisticated, but it is not impossible
(Fennelly 2016). The following would be a list of the probable cybersecurity threats that are
identified to be harming the information systems and other assets within an organization in an
organization and also for the individual users:
 Ransomware attacks: This is a kind of Malware attack that has the potential
of locking a system connected to the internet completely to not let it access the
files in the system and this is done by typical encryption forms developed by
an attacker (Benson and Rahman 2015). Then they would ask for ransom for
the as a form of payment, and only after the payment has been made, the
attackers would allow to decrypt the systems and unlock them to let the users
access the systems again.
 Malware attacks: These creep into a system connected to the internet in such
a way that they cannot be identified as they come in the forms of an
unsuspecting file or program which is used for harming a computer in the
form of spyware, computer viruses, computer worms and Trojan horses
(Souag et al. 2015).

 Social Engineering: This attack is dependent on the interactions between the
human and the computer to other users interacting through internet as well.
This mostly occurs on the social networking websites, where people do not
have an idea of the people they are interacting to as it is not a face to face
conversation. This is why it is easier to trick the users to barge into the
computer systems with the help of such interactions and this is why it is easier
to break into the security systems having the trust of users. Sensitive
information about the users are easier to breach into and steal in this way.
 Phishing attacks: The phishing cyber attacks are devised through the frauds
that are continued through the sending of fraudulent emails sent to a user
(Mann 2017). This resembles as an email coming from a trusted source and
this is why people tend to be falling victim to the emails. These have the
potential of making the users install malicious applications that would have
the potential of stealing away data and information including the sensitive
private data, credit card information and transactional details.
Why is it important for ABC Technologies?
The company of ABC Technologies deal with a huge range of technology products
and this is also the form of product and services they provide their customers with. The
company had implemented cloud services for the over 10,000 customer they serve and deals
with all the benefits available for the Information and Communication Technologies. Due to
this, the company has already been fallen victim to the cyber-attacks before and this is why
the company is mostly looking forward to the retention of the customers by analysing the
security situation of the company and figuring out how the organization is able to improve

more in the security department to serve the customers in a better way and retain the market
reputation that they have gained so far (Parsons et al. 2015).
The company also utilizes the likes of VPNs and has also developed BYOD systems
for connecting all the branches all over Australia and let the employees working in the
different areas to be connected to the headquarters (Islam, Manivannan and Zeadally 2016).
Thus, the organization needs to identify all the security vulnerabilities that is there in the
organization because of the business systems.
Identification and explanation of 3 security vulnerabilities in the system for ABC
Technologies with proper justification taken from the research
1. The security vulnerability issues followed by the policy of Bringing Your Own Device or
BYOD
The ABC Technologies have developed a BYOD or Bring Your Own Device system
for the employees, but there are numerous security vulnerabilities associated with the system.
One of them being the obligation that the business does not provide any information
regarding the BYOD policy so it is difficult to understand if the company has developed any
policy for the employees to understand the security problems (Kuypers, Maillart and Pate-
Cornell 2016). So, they might be using the devices without proper security systems. In
addition, there are other problems associated as the device can be stolen, unsecure networks
can be witnessed, unsecure data transfer can occur making the company be vulnerable to
unidentified attacks.
2. The security issues occurring with the Virtual Private Network or VPN
The ABC Technology company does not provide information about the SOX
compliance mandates that every organization needs to mandate so that the VPN remains

secured, as there may be situations, where the VPN can be victimized during the provision of
protection to the applications and servers, thus it generates the need to make a proper security
system to be developed for the correct way of using VPN systems (Smith 2015).
3. The vulnerabilities in the security system occurring due to the storage of business
information in the Cloud Environment
Cloud systems have provided the most amount of the benefits since the time of its
inception and this is why organizations are utilizing the cloud technology in an exponentially
increased number (Norman 2016). The company has also found to be victimised due to the
implementation of the cloud storage systems and thus it is understandable that the
organization do not have a proper system for protecting the organization from cyber security
attacks that should have been there to fight the security vulnerabilities of the cloud
implementation systems.
Identification of and listing of 5 different kinds of threats that might affect the
ABC Technologies
The identification and listing of 5 different threat affecting the ABC Technologies can
be presented as follows:
 Illegal invasion
 Network eavesdropping
 DoS or Denial of Service Attack (Khan and Al-Yasiri 2016)
 Ransomware attacks
 Vulnerabilities of Virtualization

Description of the threats with their capability of causing the damages
Network Eavesdropping
This is an attack that deals with the private communication in real time via calling
over the phones, remote control of multiple workstations from varied locations and even
video conferences (Khan and Tuteja 2015). Data extraction is easier this way as this helps in
having control over the systems in communication.
Illegal invasions
This attack is easier to understand as per the nomenclature attached to it. This is an act
of barging and extracting out of data from a connecting device without having any authority
to have access to the systems (Aikat et al. 2017). The attack has a potential of extracting out
all the sensitive data from an individual user or and entire organization.
Denial of Service or DoS attacks
The kind of cyber-attack that makes a network or a machine resource be unavailable
to the users temporarily is regarded as DoS or Denial of Services attack (Yang, Ryu and Baik
2016). This makes and individual user or an organization disrupt services indefinitely from
the host by being connected to the internet.
Vulnerabilities in Virtualization
The vulnerabilities that has the potential of occurring in the organization since ABC
Technologies provides the employees around various locations in Australia in other branches
to be connected with each other through virtual platforms (Singhal and Ou 2017). They attack
all the virtualization platforms make it difficult for establishing a virtual communication or
connectivity to the remote employees and the organization.

Ransomware attacks
Ransomware can be regarded as the attacks that makes the users be unable to use their
systems and personal files being kept under hostage with the help of malware attacks by the
cyber criminals and attackers (Shameli-Sendi, Aghababaei-Barzegar and Cheriet 2016). The
usage would only be allowed if a certain amount of ransom is paid to the attackers in the form
of payment.
Responsibility of the attacks and the attacking techniques
The executive members and the managerial bodies of the ABC Technologies are at
the responsibility of making a decision for saving the organization from all the security
attacks that the company has the potential of experiencing (Li et al. 2016). If a proper
security policy and conduction system is not implemented, the organization would become
vulnerable to larger security threats because of the current business systems.
Recommendations for keeping the home and offices away from any kind of cyber
attacks
 Regular data backups on a yearly, quarterly and daily basis.
 Firewall setups for securing the computers.
 Monitoring the use of the devices (Conteh and Schmick 2016)
 Important information protection by encrypting the conversation
 Utilizing spam filtering for reducing the amount of spams and phishing email
attacks
 Keeping up with the information about the latest cyber security risks
 Managing administrative passwords by using alphanumeric codes, symbols
and combination of letters

Conclusion
Therefore, in conclusion, it can be said that the organization of ABC Technologies
have a lot of security issues to take care of analysing the current situation of the company and
the integration of the security system and ICT use in the organization. The above report has
thus been devised on the document that has been made by the Security Consultant about the
cyber security system of the organization, to make the staff have a basic idea about cyber
security and how it should be maintained within the organization. This will make sure that the
employees take care of the business according to the cybersecurity to help in the training of
the staff and also identify the security vulnerability of the organizational systems. This
documentation process also included the threats that can occur again in the organization
given the latest security systems of the organization and the ability of the threats associated to
cause harm to the organization and how they can also be eradicated.

References
Aikat, J, Akella, A, Chase, J S, Juels, A, Reiter, M, Ristenpart, T, Sekar, V and Swift, M,
2017. Rethinking security in the era of cloud computing. IEEE Security & Privacy.
Benson, K and Rahman, S, 2015. Security Risks in Mechanical Engineering Industries. arXiv
preprint arXiv:1512.01730.
Conteh, N Y and Schmick, P J, 2016. Cybersecurity: risks, vulnerabilities and
countermeasures to prevent social engineering attacks. International Journal of Advanced
Computer Research, 6(23), p.31.
Fennelly, L, 2016. Effective physical security. Butterworth-Heinemann.
Islam, T, Manivannan, D and Zeadally, S, 2016. A classification and characterization of
security threats in cloud computing. Int. J. Next-Gener. Comput, 7(1).
Khan, N and Al-Yasiri, A, 2016. Identifying cloud security threats to strengthen cloud
computing adoption framework. Procedia Computer Science, 94, pp.485-490.
Khan, S S and Tuteja, R R, 2015. Security in cloud computing using cryptographic
algorithms. International Journal of Innovative Research in Computer and Communication
Engineering, 3(1), pp.148-155.
Kuypers, M A, Maillart, T and Pate-Cornell, E, 2016. An empirical analysis of cyber security
incidents at a large organization. Department of Management Science and Engineering,
Stanford University, School of Information, UC Berkeley, http://fsi. stanford.
edu/sites/default/files/kuypersweis_v7. pdf, accessed July, 30.

Layton, T P, 2016. Information Security: Design, implementation, measurement, and
compliance. Auerbach Publications.
Li, F, Durumeric, Z, Czyz, J, Karami, M, Bailey, M, McCoy, D, Savage, S and Paxson, V,
2016. You've got vulnerability: Exploring effective vulnerability notifications. In 25th
{USENIX} Security Symposium ({USENIX} Security 16) (pp. 1033-1050).
Mann, I, 2017. Hacking the human: social engineering techniques and security
countermeasures. Routledge.
Norman, T L, 2016. Risk analysis and security countermeasure selection. CRC press.
Parsons, K M, Young, E, Butavicius, M A, McCormac, A, Pattinson, M R and Jerram, C,
2015. The influence of organizational information security culture on information security
decision making. Journal of Cognitive Engineering and Decision Making, 9(2), pp.117-129.
Pathan, A S K ed., 2016. Security of self-organizing networks: MANET, WSN, WMN,
VANET. CRC press.
Safa, N S, Sookhak, M, Von Solms, R, Furnell, S, Ghani, N A and Herawan, T, 2015.
Information security conscious care behaviour formation in organizations. Computers &
Security, 53, pp.65-78.
Shameli-Sendi, A, Aghababaei-Barzegar, R and Cheriet, M, 2016. Taxonomy of information
security risk assessment (ISRA). Computers & Security, 57, pp.14-30.
Singhal, A and Ou, X, 2017. Security risk analysis of enterprise networks using probabilistic
attack graphs. In Network Security Metrics (pp. 53-73). Springer, Cham.
Smith, R E, 2015. Elementary information security. Jones & Bartlett Publishers.

Souag, A, Salinesi, C, Mazo, R and Comyn-Wattiau, I, 2015, March. A security ontology for
security requirements elicitation. In International symposium on engineering secure software
and systems (pp. 157-177). Springer, Cham.
Yang, J, Ryu, D and Baik, J, 2016, January. Improving vulnerability prediction accuracy with
secure coding standard violation measures. In 2016 International Conference on Big Data
and Smart Computing (BigComp) (pp. 115-122). IEEE.